CVE-2020-14318

A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be unavailable to the attacker.

A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be unavailable to the attacker.

A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be unavailable to the attacker.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

The following packages have been upgraded to a later upstream version: samba (4.13.3). (BZ#1878109)

Security Fix(es):

• samba: Netlogon elevation of privilege vulnerability (Zerologon) (CVE-2020-1472)

• samba: Missing handle permissions check in SMB1/2/3 ChangeNotify (CVE-2020-14318)

• samba: Unprivileged user can crash winbind (CVE-2020-14323)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.4 Release Notes linked from the References section.

A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be unavailable to the attacker.

Samba is an open-source implementation of the Server Message Block (SMB) protocol and the related Common Internet File System (CIFS) protocol, which allow PC-compatible machines to share files, printers, and various information.

The following packages have been upgraded to a later upstream version: samba (4.13.3). (BZ#1878109)

Security Fix(es):

• samba: Netlogon elevation of privilege vulnerability (Zerologon) (CVE-2020-1472)

• samba: Missing handle permissions check in SMB1/2/3 ChangeNotify (CVE-2020-14318)

• samba: Unprivileged user can crash winbind (CVE-2020-14323)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Steven French discovered that Samba incorrectly handled ChangeNotify permissions. A remote attacker could possibly use this issue to obtain file name information (CVE-2020-14318).

Bas Alberts discovered that Samba incorrectly handled certain winbind requests. A remote attacker could possibly use this issue to cause winbind to crash, resulting in a denial of service (CVE-2020-14323).

Francis Brosnan Blázquez discovered that Samba incorrectly handled certain invalid DNS records. A remote attacker could possibly use this issue to cause the DNS server to crash, resulting in a denial of service (CVE-2020-14383).

This update for samba fixes the following issues:

• CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613).
• CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for samba fixes the following issues:

Update to samba 4.11.14

• CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613).
• CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).
• lib/util: Do not install /usr/bin/test_util
• smbd: don't log success as error
• idmap_ad does not deal properly with a RFC4511 section 4.4.1 response;
• winbind: Fix a memleak
• idmap_ad: Pass tldap debug messages on to DEBUG()
• lib/replace: Move lib/replace/closefrom.c from ROKEN_HOSTCC_SOURCE to REPLACE_HOSTCC_SOURCE
• ctdb disable/enable can fail due to race condition

This update was imported from the SUSE:SLE-15-SP2:Update update project.

These are all security issues fixed in the ctdb-4.14.6+git.182.2205d5224e3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for samba fixes the following issues:

• CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).

This update for samba fixes the following issues:

Update to samba 4.11.14

• CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613).
• CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).
• lib/util: Do not install /usr/bin/test_util
• smbd: don't log success as error
• idmap_ad does not deal properly with a RFC4511 section 4.4.1 response;
• winbind: Fix a memleak
• idmap_ad: Pass tldap debug messages on to DEBUG()
• lib/replace: Move lib/replace/closefrom.c from ROKEN_HOSTCC_SOURCE to REPLACE_HOSTCC_SOURCE
• ctdb disable/enable can fail due to race condition

This update for samba fixes the following issues:

• CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613).
• CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).

This update for samba fixes the following issues:

• CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).

This update for samba fixes the following issues:

• CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613).
• CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).

This update for samba fixes the following issues:

• CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613).
• CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).

This update for samba fixes the following issues:

• CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records (bsc#1177613).
• CVE-2020-14323: Unprivileged user can crash winbind (bsc#1173994).
• CVE-2020-14318: Missing permissions check in SMB1/2/3 ChangeNotify (bsc#1173902).

This update for samba fixes the following issues:

• Update to 4.13.3

  • libcli: smb2: Never print length if smb2_signing_key_valid() fails for crypto blob; (bso#14210);
  • s3: modules: gluster. Fix the error I made in preventing talloc leaks from a function; (bso#14486);
  • s3: smbd: Don't overwrite contents of fsp->aio_requests[0] with NULL via TALLOC_FREE(); (bso#14515);
  • s3: spoolss: Make parameters in call to user_ok_token() match all other uses; (bso#14568);
  • s3: smbd: Quiet log messages from usershares for an unknown share; (bso#14590);
  • samba process does not honor max log size; (bso#14248);
  • vfs_zfsacl: Add missing inherited flag on hidden 'magic' everyone@ ACE; (bso#14587);
  • s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  • s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  • smbclient: Fix recursive mget; (bso#14517);
  • clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  • manpages/vfs_glusterfs: Mention silent skipping of write-behind translator; (bso#14486);
  • vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  • interface: Fix if_index is not parsed correctly; (bso#14514);

• Update to 4.13.2

  • s3: modules: vfs_glusterfs: Fix leak of char **lines onto mem_ctx on return; (bso#14486);
  • RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471);
  • smb.conf.5: Add clarification how configuration changes reflected by Samba; (bso#14538);
  • daemons: Report status to systemd even when running in foreground; (bso#14552);
  • DNS Resolver: Support both dnspython before and after 2.0.0; (bso#14553);
  • s3-vfs_glusterfs: Refuse connection when write-behind xlator is present; (bso#14486);
  • provision: Add support for BIND 9.16.x; (bso#14487);
  • ctdb-common: Avoid aliasing errors during code optimization; (bso#14537);
  • libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  • docs: Fix default value of spoolss:architecture; (bso#14522);
  • winbind: Fix a memleak; (bso#14388);
  • s4:dsdb:acl_read: Implement 'List Object' mode feature; (bso#14531);
  • docs-xml/manpages: Add warning about write-behind translator for vfs_glusterfs; (bso#14486);
  • nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  • vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  • third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  • examples:auth: Do not install example plugin; (bso#14550);
  • ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  • RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471);

• Adjust smbcacls '--propagate-inheritance' feature to align with upstream; (bsc#1178469).

• Update to samba 4.13.1

  • CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records; (bsc#1177613); (bso#14472);
  • CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994); (bso#14436);
  • CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify; (bsc#1173902); (bso#14434);

• Adjust systemd tmpfiles.d configuration, use /run/samba instead of /var/run/samba; (bsc#1177355);

Steven French discovered that Samba incorrectly handled ChangeNotify permissions. A remote attacker could possibly use this issue to obtain file name information. (CVE-2020-14318)

Bas Alberts discovered that Samba incorrectly handled certain winbind requests. A remote attacker could possibly use this issue to cause winbind to crash, resulting in a denial of service. (CVE-2020-14323)

Francis Brosnan Blázquez discovered that Samba incorrectly handled certain invalid DNS records. A remote attacker could possibly use this issue to cause the DNS server to crash, resulting in a denial of service. (CVE-2020-14383)

Steven French discovered that Samba incorrectly handled ChangeNotify permissions. A remote attacker could possibly use this issue to obtain file name information. (CVE-2020-14318)

Bas Alberts discovered that Samba incorrectly handled certain winbind requests. A remote attacker could possibly use this issue to cause winbind to crash, resulting in a denial of service. (CVE-2020-14323)

Francis Brosnan Blázquez discovered that Samba incorrectly handled certain invalid DNS records. A remote attacker could possibly use this issue to cause the DNS server to crash, resulting in a denial of service. (CVE-2020-14383)

Peter Eriksson discovered that Samba incorrectly handled certain negative idmap cache entries. This issue could result in certain users gaining unauthorized access to files, contrary to expected behaviour. (CVE-2021-20254)